Executive brief
BleachBit is a file-cleaning utility that deletes files to free disk space and protect privacy. On Windows, when BleachBit runs with elevated privileges, an unprivileged attacker can use directory junctions and symbolic links to trick the elevated process into deleting arbitrary files, then leverage Windows Installer behavior to gain full system control. This could allow complete system compromise by an attacker with basic local access.
Technical details
BleachBit's privileged Windows file deletion fails to lock and validate the parent directory before deletion, allowing a local unprivileged user to replace the target's parent directory with a Windows junction and redirect the elevated deletion to attacker-chosen files via native symlinks. The arbitrary privileged file deletion can be combined with Windows Installer behavior to achieve local privilege escalation to SYSTEM. The fix (version 6.0.1) implements parent directory locking on Windows with optimizations to skip locks for non-admin users and user profile paths.
Affected products
- BleachBit BleachBit before 6.0.1
Timeline
- 2026-09-21: disclosed: Vulnerability published to NVD
- 2026-05-10: patched: Fix committed fixing parent directory locking (commit ee12823)
- 2026-05-03: other: Fix authored, reported by Zeze with TeamT5